DevicePolicyManager

Public interface for managing policies enforced on a device. Most clients of this class must be
registered with the system as a device
administrator. Additionally, a device administrator may be registered as either a profile or
device owner. A given method is accessible to all device administrators unless the documentation
for that method specifies that it is restricted to either device or profile owners. Any
application calling an api may only pass as an argument a device administrator component it
owns. Otherwise, a SecurityException will be thrown.

Developer Guides

For more information about managing policies for device administration, read the Device Administration developer
guide.

A Parcelable extra of type PersistableBundle that
allows a mobile device management application or NFC programmer application which starts
managed provisioning to pass data to the management application instance after provisioning.

Retrieve the current maximum number of login attempts that are allowed before the device
or profile is wiped, for a particular admin or all admins that set restrictions on this user
and its participating profiles.

Causes the current thread to wait until another thread invokes the
notify() method or the
notifyAll() method for this object, or
some other thread interrupts the current thread, or a certain
amount of real time has elapsed.

Constants

ACTION_ADD_DEVICE_ADMIN

Activity action: ask the user to add a new device administrator to the system.
The desired policy is the ComponentName of the policy in the
EXTRA_DEVICE_ADMIN extra field. This will invoke a UI to
bring the user through adding the device administrator to the system (or
allowing them to reject it).

You can optionally include the EXTRA_ADD_EXPLANATION
field to provide the user with additional explanation (in addition
to your component's description) about what is being added.

If your administrator is already active, this will ordinarily return immediately (without
user intervention). However, if your administrator has been updated and is requesting
additional uses-policy flags, the user will be presented with the new list. New policies
will not be available to the updated administrator until the user has accepted the new list.

A result code of RESULT_OK implies that the synchronous part
of the provisioning flow was successful, although this doesn't guarantee the full flow will
succeed. Conversely a result code of RESULT_CANCELED implies
that the user backed-out of provisioning, or some precondition for provisioning wasn't met.

If provisioning fails, the managedProfile is removed so the device returns to its
previous state.

If launched with startActivityForResult(Intent, int) a
result code of RESULT_OK implies that the synchronous part of
the provisioning flow was successful, although this doesn't guarantee the full flow will
succeed. Conversely a result code of RESULT_CANCELED implies
that the user backed-out of provisioning, or some precondition for provisioning wasn't met.

Constant Value:
"android.app.action.PROVISION_MANAGED_PROFILE"

ACTION_SET_NEW_PARENT_PROFILE_PASSWORD

Activity action: have the user enter a new password for the parent profile.
If the intent is launched from within a managed profile, this will trigger
entering a new password for the parent of the profile. In all other cases
the behaviour is identical to ACTION_SET_NEW_PASSWORD.

Constant Value:
"android.app.action.SET_NEW_PARENT_PROFILE_PASSWORD"

ACTION_SET_NEW_PASSWORD

Activity action: have the user enter a new password. This activity should
be launched after using setPasswordQuality(ComponentName, int),
or setPasswordMinimumLength(ComponentName, int) to have the user
enter a new password that meets the current requirements. You can use
isActivePasswordSufficient() to determine whether you need to
have the user select a new password in order to meet the current
constraints. Upon being resumed from this activity, you can check the new
password characteristics to see if they are sufficient.
If the intent is launched from within a managed profile with a profile
owner built against M or before,
this will trigger entering a new password for the parent of the profile.
For all other cases it will trigger entering a new password for the user
or profile it is launched from.

ACTION_START_ENCRYPTION

Activity action: begin the process of encrypting data on the device. This activity should
be launched after using setStorageEncryption(ComponentName, boolean) to request encryption be activated.
After resuming from this activity, use getStorageEncryption(ComponentName)
to check encryption status. However, on some devices this activity may never return, as
it may trigger a reboot and in some cases a complete data wipe of the device.

ENCRYPTION_STATUS_ACTIVATING

Result code for getStorageEncryptionStatus():
indicating that encryption is not currently active, but is currently
being activated. This is only reported by devices that support
encryption of data and only when the storage is currently
undergoing a process of becoming encrypted. A device that must reboot and/or wipe data
to become encrypted will never return this value.

ENCRYPTION_STATUS_ACTIVE_PER_USER

This value is only returned to apps targeting API level 24 and above. For apps targeting
earlier API levels, ENCRYPTION_STATUS_ACTIVE is returned, even if the
encryption key is specific to the user or profile.

EXTRA_PROVISIONING_ACCOUNT_TO_MIGRATE

An Account extra holding the account to migrate during managed
profile provisioning. If the account supplied is present in the primary user, it will be
copied, along with its credentials to the managed profile and removed from the primary user.
Use with ACTION_PROVISION_MANAGED_PROFILE.

Constant Value:
"android.app.extra.PROVISIONING_ACCOUNT_TO_MIGRATE"

EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE

A Parcelable extra of type PersistableBundle that
allows a mobile device management application or NFC programmer application which starts
managed provisioning to pass data to the management application instance after provisioning.

EXTRA_PROVISIONING_DEVICE_ADMIN_MINIMUM_VERSION_CODE

An int extra holding a minimum required version code for the device admin package. If the
device admin is already installed on the device, it will only be re-downloaded from
EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION if the version of the
installed package is less than this version code.

Either this extra or EXTRA_PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM must be
present. The provided checksum must match the checksum of the file at the download
location. If the checksum doesn't match an error will be shown to the user and the user will
be asked to factory reset the device.

Note: for devices running LOLLIPOP
and LOLLIPOP_MR1 only SHA-1 hash is supported.
Starting from M, this parameter accepts SHA-256 in
addition to SHA-1. Support for SHA-1 is likely to be removed in future OS releases.

A String extra holding the package name of the mobile device management application that
will be set as the profile owner or device owner.

If an application starts provisioning directly via an intent with action
ACTION_PROVISION_MANAGED_PROFILE this package has to match the package name of the
application that started provisioning. The package will be set as profile owner in that case.

This package is set as device owner when device owner provisioning is started by an NFC
message containing an NFC record with MIME type MIME_TYPE_PROVISIONING_NFC.

When this extra is set, the application must have exactly one device admin receiver.
This receiver will be set as the profile or device owner and active admin.

Either this extra or EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM must be
present. The provided checksum must match the checksum of any signature of the file at
the download location. If the checksum does not match an error will be shown to the user and
the user will be asked to factory reset the device.

If the ACTION_PROVISION_MANAGED_PROFILE intent that starts managed provisioning
contains this extra, it is forwarded in the
ACTION_PROFILE_PROVISIONING_COMPLETE intent to the mobile
device management application that was set as the profile owner during provisioning.
It is usually used to avoid that the user has to enter their email address twice.

MIME_TYPE_PROVISIONING_NFC

During device owner provisioning a device admin app is set as the owner of the device.
A device owner has full control over the device. The device owner can not be modified by the
user and the only way of resetting the device is if the device owner app calls a factory
reset.

A typical use case would be a device that is owned by a company, but used by either an
employee or client.

The NFC message must be sent to an unprovisioned device.

The NFC record must contain a serialized Properties object which
contains the following properties:

PASSWORD_QUALITY_ALPHABETIC

Constant for setPasswordQuality(ComponentName, int): the user must have entered a
password containing at least alphabetic (or other symbol) characters.
Note that quality constants are ordered so that higher values are more
restrictive.

Constant Value:
262144
(0x00040000)

PASSWORD_QUALITY_ALPHANUMERIC

Constant for setPasswordQuality(ComponentName, int): the user must have entered a
password containing at least both> numeric and
alphabetic (or other symbol) characters. Note that quality constants are
ordered so that higher values are more restrictive.

Constant Value:
327680
(0x00050000)

PASSWORD_QUALITY_BIOMETRIC_WEAK

Constant for setPasswordQuality(ComponentName, int): the policy allows for low-security biometric
recognition technology. This implies technologies that can recognize the identity of
an individual to about a 3 digit PIN (false detection is less than 1 in 1,000).
Note that quality constants are ordered so that higher values are more restrictive.

Constant Value:
32768
(0x00008000)

PASSWORD_QUALITY_COMPLEX

Constant for setPasswordQuality(ComponentName, int): the user must have entered a
password containing at least a letter, a numerical digit and a special
symbol, by default. With this password quality, passwords can be
restricted to contain various sets of characters, like at least an
uppercase letter, etc. These are specified using various methods,
like setPasswordMinimumLowerCase(ComponentName, int). Note
that quality constants are ordered so that higher values are more
restrictive.

Constant Value:
393216
(0x00060000)

PASSWORD_QUALITY_NUMERIC

Constant for setPasswordQuality(ComponentName, int): the user must have entered a
password containing at least numeric characters. Note that quality
constants are ordered so that higher values are more restrictive.

Constant Value:
131072
(0x00020000)

PASSWORD_QUALITY_NUMERIC_COMPLEX

Constant for setPasswordQuality(ComponentName, int): the user must have entered a
password containing at least numeric characters with no repeating (4444)
or ordered (1234, 4321, 2468) sequences. Note that quality
constants are ordered so that higher values are more restrictive.

Constant Value:
196608
(0x00030000)

PASSWORD_QUALITY_SOMETHING

Constant for setPasswordQuality(ComponentName, int): the policy requires some kind
of password or pattern, but doesn't care what it is. Note that quality constants
are ordered so that higher values are more restrictive.

RESET_PASSWORD_DO_NOT_ASK_CREDENTIALS_ON_BOOT

Flag for resetPassword(String, int): don't ask for user credentials on device boot.
If the flag is set, the device can be booted without asking for user password.
The absence of this flag does not change the current boot requirements. This flag
can be set by the device owner only. If the app is not the device owner, the flag
is ignored. Once the flag is set, it cannot be reverted back without resetting the
device to factory defaults.

addCrossProfileWidgetProvider

Called by the profile owner of a managed profile to enable widget providers from a given
package to be available in the parent profile. As a result the user will be able to add
widgets from the white-listed package running under the profile to a widget host which runs
under the parent profile, for example the home screen. Note that a package may have zero or
more provider components, where each component provides a different widget type.

addPersistentPreferredActivity

Called by a profile owner or device owner to add a default intent handler activity for
intents that match a certain intent filter. This activity will remain the default intent
handler even if the set of potential event handlers for the intent filter changes and if the
intent preferences are reset.

The default disambiguation mechanism takes over if the activity is not installed (anymore).
When the activity is (re)installed, it is automatically reset as default intent handler for
the filter.

The calling device admin must be a profile owner or device owner. If it is not, a security
exception will be thrown.

clearCrossProfileIntentFilters

Called by a profile owner of a managed profile to remove the cross-profile intent filters
that go from the managed profile to the parent, or from the parent to the managed profile.
Only removes those that have been set by the profile owner.

clearDeviceOwnerApp

Clears the current device owner. The caller must be the device owner. This function should be
used cautiously as once it is called it cannot be undone. The device owner can only be set as
a part of device setup before setup completes.

createAndManageUser

Called by a device owner to create a user with the specified name and a given component of
the calling package as profile owner. The UserHandle returned by this method should not be
persisted as user handles are recycled as users are removed and created. If you need to
persist an identifier for this user, use getSerialNumberForUser(UserHandle). The new
user will not be started in the background.

admin is the DeviceAdminReceiver which is the device owner. profileOwner is also a
DeviceAdminReceiver in the same package as admin, and will become the profile owner and will
be registered as an active admin on the new user. The profile owner package will be installed
on the new user.

If the adminExtras are not null, they will be stored on the device until the user is started
for the first time. Then the extras will be passed to the admin when onEnable is called.

getAlwaysOnVpnPackage

Called by a device or profile owner to read the name of the package administering an
always-on VPN connection for the current user. If there is no such package, or the always-on
VPN is provided by the system instead of by an application, null will be returned.

getKeyguardDisabledFeatures

Determine whether or not features have been disabled in keyguard either by the calling
admin, if specified, or all admins that set restrictions on this user and its participating
profiles. Restrictions on profiles that have a separate challenge are not taken into account.

getMaximumFailedPasswordsForWipe

Retrieve the current maximum number of login attempts that are allowed before the device
or profile is wiped, for a particular admin or all admins that set restrictions on this user
and its participating profiles. Restrictions on profiles that have a separate challenge are
not taken into account.

getMaximumTimeToLock

Retrieve the current maximum time to unlock for a particular admin or all admins that set
restrictions on this user and its participating profiles. Restrictions on profiles that have
a separate challenge are not taken into account.

getPasswordExpiration

Get the current password expiration time for a particular admin or all admins that set
restrictions on this user and its participating profiles. Restrictions on profiles that have
a separate challenge are not taken into account. If admin is null, then a composite
of all expiration times is returned - which will be the minimum of all of them.

getPasswordExpirationTimeout

Get the password expiration timeout for the given admin. The expiration timeout is the
recurring expiration timeout provided in the call to
setPasswordExpirationTimeout(ComponentName, long) for the given admin or the
aggregate of all participating policy administrators if admin is null. Admins that
have set restrictions on profiles that have a separate challenge are not taken into account.

getPasswordHistoryLength

Retrieve the current password history length for a particular admin or all admins that
set restrictions on this user and its participating profiles. Restrictions on profiles that
have a separate challenge are not taken into account.

getPasswordMinimumLength

Retrieve the current minimum password length for a particular admin or all admins that set
restrictions on this user and its participating profiles. Restrictions on profiles that have
a separate challenge are not taken into account.

getPasswordMinimumLetters

Retrieve the current number of letters required in the password
for a particular admin or all admins that set restrictions on this user
and its participating profiles. Restrictions on profiles that have
a separate challenge are not taken into account.
This is the same value as set by
setPasswordMinimumLetters(ComponentName, int)
and only applies when the password quality is
PASSWORD_QUALITY_COMPLEX.

getPasswordMinimumLowerCase

Retrieve the current number of lower case letters required in the password
for a particular admin or all admins that set restrictions on this user
and its participating profiles. Restrictions on profiles that have
a separate challenge are not taken into account.
This is the same value as set by
setPasswordMinimumLowerCase(ComponentName, int)
and only applies when the password quality is
PASSWORD_QUALITY_COMPLEX.

getPasswordMinimumNonLetter

Retrieve the current number of non-letter characters required in the password
for a particular admin or all admins that set restrictions on this user
and its participating profiles. Restrictions on profiles that have
a separate challenge are not taken into account.
This is the same value as set by
setPasswordMinimumNonLetter(ComponentName, int)
and only applies when the password quality is
PASSWORD_QUALITY_COMPLEX.

getPasswordMinimumNumeric

Retrieve the current number of numerical digits required in the password
for a particular admin or all admins that set restrictions on this user
and its participating profiles. Restrictions on profiles that have
a separate challenge are not taken into account.
This is the same value as set by
setPasswordMinimumNumeric(ComponentName, int)
and only applies when the password quality is
PASSWORD_QUALITY_COMPLEX.

getPasswordMinimumSymbols

Retrieve the current number of symbols required in the password
for a particular admin or all admins that set restrictions on this user
and its participating profiles. Restrictions on profiles that have
a separate challenge are not taken into account. This is the same value as
set by setPasswordMinimumSymbols(ComponentName, int)
and only applies when the password quality is
PASSWORD_QUALITY_COMPLEX.

getPasswordMinimumUpperCase

Retrieve the current number of upper case letters required in the password
for a particular admin or all admins that set restrictions on this user and
its participating profiles. Restrictions on profiles that have a separate challenge
are not taken into account.
This is the same value as set by
setPasswordMinimumUpperCase(ComponentName, int)
and only applies when the password quality is
PASSWORD_QUALITY_COMPLEX.

getPasswordQuality

Retrieve the current minimum password quality for a particular admin or all admins that set
restrictions on this user and its participating profiles. Restrictions on profiles that have
a separate challenge are not taken into account.

getPermissionGrantState

Returns the current grant state of a runtime permission for a specific application.

Parameters

admin

ComponentName:
Which profile or device owner this request is associated with.

packageName

String:
The application to check the grant state for.

permission

String:
The permission to check for.

Returns

int

the current grant state specified by device policy. If the profile or device owner
has not set a grant state, the return value is
PERMISSION_GRANT_STATE_DEFAULT. This does not indicate whether or not the
permission is currently granted for the package.

hasGrantedPolicy

Returns true if an administrator has been granted a particular device policy. This can be
used to check whether the administrator was activated under an earlier set of policies, but
requires additional policies after an upgrade.

Parameters

admin

ComponentName:
Which DeviceAdminReceiver this request is associated with. Must be an
active administrator, or an exception will be thrown.

installKeyPair

Called by a device or profile owner, or delegated certificate installer, to install a
certificate chain and corresponding private key for the leaf certificate. All apps within the
profile will be able to access the certificate chain and use the private key, given direct
user approval.

The caller of this API may grant itself access to the certificate and private key
immediately, without user approval. It is a best practice not to request this unless strictly
necessary since it opens up additional security vulnerabilities.

Parameters

admin

ComponentName:
Which DeviceAdminReceiver this request is associated with, or
null if calling from a delegated certificate installer.

privKey

PrivateKey:
The private key to install.

certs

Certificate:
The certificate chain to install. The chain should start with the leaf
certificate and include the chain of trust in order. This will be returned by
getCertificateChain(Context, String).

alias

String:
The private key alias under which to install the certificate. If a certificate
with that alias already exists, it will be overwritten.

requestAccess

boolean:
true to request that the calling app be granted access to the
credentials immediately. Otherwise, access to the credentials will be gated by user
approval.

installKeyPair

Called by a device or profile owner, or delegated certificate installer, to install a
certificate and corresponding private key. All apps within the profile will be able to access
the certificate and use the private key, given direct user approval.

Access to the installed credentials will not be granted to the caller of this API without
direct user approval. This is for security - should a certificate installer become
compromised, certificates it had already installed will be protected.

isActivePasswordSufficient

Determine whether the current password the user has set is sufficient to meet the policy
requirements (e.g. quality, minimum length) that have been requested by the admins of this
user and its participating profiles. Restrictions on profiles that have a separate challenge
are not taken into account.

The calling device admin must have requested
USES_POLICY_LIMIT_PASSWORD to be able to call this method; if it has
not, a security exception will be thrown.

isDeviceOwnerApp

Used to determine if a particular package has been registered as a Device Owner app.
A device owner app is a special device admin that cannot be deactivated by the user, once
activated as a device admin. It also cannot be uninstalled. To check whether a particular
package is currently registered as the device owner app, pass in the package name from
getPackageName() to this method.

This is useful for device
admin apps that want to check whether they are also registered as the device owner app. The
exact mechanism by which a device admin app is registered as a device owner app is defined by
the setup process.

Parameters

packageName

String:
the package name of the app, to compare with the registered device owner
app, if any.

isUninstallBlocked

Check whether the user has been blocked by device policy from uninstalling a package.
Requires the caller to be the profile owner if checking a specific admin's policy.

Note: Starting from LOLLIPOP_MR1, the
behavior of this API is changed such that passing null as the admin parameter
will return if any admin has blocked the uninstallation. Before L MR1, passing null
will cause a NullPointerException to be raised.

Parameters

admin

ComponentName:
The name of the admin component whose blocking policy will be checked, or
null to check whether any admin has blocked the uninstallation.

removeActiveAdmin

Remove a current administration component. This can only be called
by the application that owns the administration component; if you
try to remove someone else's component, a security exception will be
thrown.

Note that the operation is not synchronous and the admin might still be active (as
indicated by getActiveAdmins()) by the time this method returns.

true if the bugreport collection started successfully, or false if it
wasn't triggered because a previous bugreport operation is still active (either the
bugreport is still running or waiting for the user to share or decline)

resetPassword

Force a new device unlock password (the password needed to access the entire device, not for
individual accounts) on the user. This takes effect immediately.

Note: This API has been limited as of N for
device admins that are not device owner and not profile owner.
The password can now only be changed if there is currently no password set. Device owner
and profile owner can still do this when user is unlocked and does not have a managed
profile.

The given password must be sufficient for the current password quality and length constraints
as returned by getPasswordQuality(ComponentName) and
getPasswordMinimumLength(ComponentName); if it does not meet these constraints, then
it will be rejected and false returned. Note that the password may be a stronger quality
(containing alphanumeric characters when the requested quality is only numeric), in which
case the currently active quality will be increased to match.

Calling with a null or empty password will clear any existing PIN, pattern or password if the
current password constraints allow it. Note: This will not work in
N and later for managed profiles, or for device admins
that are not device owner or profile owner. Once set, the password cannot be changed to null
or empty except by these admins.

The calling device admin must have requested
USES_POLICY_RESET_PASSWORD to be able to call this method; if it has
not, a security exception will be thrown.

Parameters

password

String:
The new password for the user. Null or empty clears the password.

retrievePreRebootSecurityLogs

Called by device owners to retrieve device logs from before the device's last reboot.

This API is not supported on all devices. Calling this API on unsupported devices
will result in null being returned. The device logs are retrieved from a RAM region
which is not guaranteed to be corruption-free during power cycles, as a result be cautious
about data corruption when parsing.

There must be only one user on the device, managed by the device owner. Otherwise a
SecurityException will be thrown.

String:
The package name for an installed VPN app on the device, or null to
remove an existing always-on VPN configuration.

lockdownEnabled

boolean:
true to disallow networking when the VPN is not connected or
false otherwise. This carries the risk that any failure of the VPN provider
could break networking for all apps. This has no effect when clearing.

setCameraDisabled

Called by an application that is administering the device to disable all cameras on the
device, for this user. After setting this, no applications running as this user will be able
to access any cameras on the device.

If the caller is device owner, then the restriction will be applied to all users.

The calling device admin must have requested
USES_POLICY_DISABLE_CAMERA to be able to call this method; if it has
not, a security exception will be thrown.

Delegated certificate installer is a per-user state. The delegated access is persistent until
it is later cleared by calling this method with a null value or uninstallling the certificate
installer.

Note:Starting from N, if the caller
application's target SDK version is N or newer, the
supplied certificate installer package must be installed when calling this API, otherwise an
IllegalArgumentException will be thrown.

setDeviceOwnerLockScreenInfo

If the device owner information is null or empty then the device owner info is
cleared and the user owner info is shown on the lock screen if it is set.

If the device owner information contains only whitespaces then the message on the lock screen
will be blank and the user will not be allowed to change it.

If the device owner information needs to be localized, it is the responsibility of the
DeviceAdminReceiver to listen to the ACTION_LOCALE_CHANGED broadcast
and set a new version of this string accordingly.

Parameters

admin

ComponentName:
The name of the admin component to check.

info

CharSequence:
Device owner information which will be displayed instead of the user owner info.

setKeyguardDisabled

Setting the keyguard to disabled has the same effect as choosing "None" as the screen lock
type. However, this call has no effect if a password, pin or pattern is currently set. If a
password, pin or pattern is set after the keyguard was disabled, the keyguard stops being
disabled.

setKeyguardDisabledFeatures

Called by an application that is administering the device to disable keyguard customizations,
such as widgets. After setting this, keyguard features will be disabled according to the
provided feature list.

setLockTaskPackages

Any packages that shares uid with an allowed package will also be allowed to activate lock
task. From M removing packages from the lock task
package list results in locked tasks belonging to those packages to be finished. This
function can only be called by the device owner.

setLongSupportMessage

Called by a device admin to set the long support message. This will be displayed to the user
in the device administators settings screen.

If the long support message needs to be localized, it is the responsibility of the
DeviceAdminReceiver to listen to the ACTION_LOCALE_CHANGED broadcast
and set a new version of this string accordingly.

setMaximumFailedPasswordsForWipe

Setting this to a value greater than zero enables a built-in policy that will perform a
device or profile wipe after too many incorrect device-unlock passwords have been entered.
This built-in policy combines watching for failed passwords and wiping the device, and
requires that you request both USES_POLICY_WATCH_LOGIN and
USES_POLICY_WIPE_DATA}.

To implement any other policy (e.g. wiping data for a particular application only, erasing or
revoking credentials, or reporting the failure to a server), you should implement
onPasswordFailed(Context, android.content.Intent) instead. Do not
use this API, because if the maximum count is reached, the device or profile will be wiped
immediately, and your callback will not be invoked.

setMaximumTimeToLock

Called by an application that is administering the device to set the maximum time for user
activity until the device will lock. This limits the length that the user can set. It takes
effect immediately.

The calling device admin must have requested USES_POLICY_FORCE_LOCK
to be able to call this method; if it has not, a security exception will be thrown.

setOrganizationColor

Called by a profile owner of a managed profile to set the color used for customization. This
color is used as background color of the confirm credentials screen for that user. The
default color is teal (#00796B).

setPasswordExpirationTimeout

Called by a device admin to set the password expiration timeout. Calling this method will
restart the countdown for password expiration for the given admin, as will changing the
device password (for all admins).

The provided timeout is the time delta in ms and will be added to the current time. For
example, to have the password expire 5 days from now, timeout would be 5 * 86400 * 1000 =
432000000 ms for timeout.

To disable password expiration, a value of 0 may be used for timeout.

The calling device admin must have requested
USES_POLICY_EXPIRE_PASSWORD to be able to call this method; if it has
not, a security exception will be thrown.

Note that setting the password will automatically reset the expiration time for all active
admins. Active admins do not need to explicitly call this method in that case.

setPasswordMinimumLetters

Called by an application that is administering the device to set the minimum number of
letters required in the password. After setting this, the user will not be able to enter a
new password that is not at least as restrictive as what has been set. Note that the current
password will remain until the user has set a new one, so the change does not take place
immediately. To prompt the user for a new password, use ACTION_SET_NEW_PASSWORD or
ACTION_SET_NEW_PARENT_PROFILE_PASSWORD after setting this value. This constraint is
only imposed if the administrator has also requested PASSWORD_QUALITY_COMPLEX with
setPasswordQuality(ComponentName, int). The default value is 1.

The calling device admin must have requested
USES_POLICY_LIMIT_PASSWORD to be able to call this method; if it has
not, a security exception will be thrown.

setPasswordMinimumLowerCase

Called by an application that is administering the device to set the minimum number of lower
case letters required in the password. After setting this, the user will not be able to enter
a new password that is not at least as restrictive as what has been set. Note that the
current password will remain until the user has set a new one, so the change does not take
place immediately. To prompt the user for a new password, use
ACTION_SET_NEW_PASSWORD or ACTION_SET_NEW_PARENT_PROFILE_PASSWORD after
setting this value. This constraint is only imposed if the administrator has also requested
PASSWORD_QUALITY_COMPLEX with setPasswordQuality(ComponentName, int). The default value is 0.

The calling device admin must have requested
USES_POLICY_LIMIT_PASSWORD to be able to call this method; if it has
not, a security exception will be thrown.

setPasswordMinimumNonLetter

Called by an application that is administering the device to set the minimum number of
non-letter characters (numerical digits or symbols) required in the password. After setting
this, the user will not be able to enter a new password that is not at least as restrictive
as what has been set. Note that the current password will remain until the user has set a new
one, so the change does not take place immediately. To prompt the user for a new password,
use ACTION_SET_NEW_PASSWORD or ACTION_SET_NEW_PARENT_PROFILE_PASSWORD after
setting this value. This constraint is only imposed if the administrator has also requested
PASSWORD_QUALITY_COMPLEX with setPasswordQuality(ComponentName, int). The default value is 0.

The calling device admin must have requested
USES_POLICY_LIMIT_PASSWORD to be able to call this method; if it has
not, a security exception will be thrown.

setPasswordMinimumNumeric

Called by an application that is administering the device to set the minimum number of
numerical digits required in the password. After setting this, the user will not be able to
enter a new password that is not at least as restrictive as what has been set. Note that the
current password will remain until the user has set a new one, so the change does not take
place immediately. To prompt the user for a new password, use
ACTION_SET_NEW_PASSWORD or ACTION_SET_NEW_PARENT_PROFILE_PASSWORD after
setting this value. This constraint is only imposed if the administrator has also requested
PASSWORD_QUALITY_COMPLEX with setPasswordQuality(ComponentName, int). The default value is 1.

The calling device admin must have requested
USES_POLICY_LIMIT_PASSWORD to be able to call this method; if it has
not, a security exception will be thrown.

setPasswordMinimumSymbols

Called by an application that is administering the device to set the minimum number of
symbols required in the password. After setting this, the user will not be able to enter a
new password that is not at least as restrictive as what has been set. Note that the current
password will remain until the user has set a new one, so the change does not take place
immediately. To prompt the user for a new password, use ACTION_SET_NEW_PASSWORD or
ACTION_SET_NEW_PARENT_PROFILE_PASSWORD after setting this value. This constraint is
only imposed if the administrator has also requested PASSWORD_QUALITY_COMPLEX with
setPasswordQuality(ComponentName, int). The default value is 1.

The calling device admin must have requested
USES_POLICY_LIMIT_PASSWORD to be able to call this method; if it has
not, a security exception will be thrown.

setPasswordMinimumUpperCase

Called by an application that is administering the device to set the minimum number of upper
case letters required in the password. After setting this, the user will not be able to enter
a new password that is not at least as restrictive as what has been set. Note that the
current password will remain until the user has set a new one, so the change does not take
place immediately. To prompt the user for a new password, use
ACTION_SET_NEW_PASSWORD or ACTION_SET_NEW_PARENT_PROFILE_PASSWORD after
setting this value. This constraint is only imposed if the administrator has also requested
PASSWORD_QUALITY_COMPLEX with setPasswordQuality(ComponentName, int). The default value is 0.

The calling device admin must have requested
USES_POLICY_LIMIT_PASSWORD to be able to call this method; if it has
not, a security exception will be thrown.

setPasswordQuality

Called by an application that is administering the device to set the password restrictions it
is imposing. After setting this, the user will not be able to enter a new password that is
not at least as restrictive as what has been set. Note that the current password will remain
until the user has set a new one, so the change does not take place immediately. To prompt
the user for a new password, use ACTION_SET_NEW_PASSWORD or
ACTION_SET_NEW_PARENT_PROFILE_PASSWORD after calling this method.

Quality constants are ordered so that higher values are more restrictive; thus the highest
requested quality constant (between the policy set here, the user's preference, and any other
considerations) is the one that is in effect.

The calling device admin must have requested
USES_POLICY_LIMIT_PASSWORD to be able to call this method; if it has
not, a security exception will be thrown.

setPermissionGrantState

Sets the grant state of a runtime permission for a specific application. The state can be
default in which a user can manage it through the UI,
denied, in which the permission is denied and the user
cannot manage it through the UI, and granted in which
the permission is granted and the user cannot manage it through the UI. This might affect all
permissions in a group that the runtime permission belongs to. This method can only be called
by a profile or device owner.

Setting the grant state to default does not revoke
the permission. It retains the previous grant, if any.

Permissions can be granted or revoked only for applications built with a
targetSdkVersion of M or later.

Parameters

admin

ComponentName:
Which profile or device owner this request is associated with.

setPermissionPolicy

Called by profile or device owners to set the default response for future runtime permission
requests by applications. The policy can allow for normal operation which prompts the user to
grant a permission, or can allow automatic granting or denying of runtime permission requests
by an application. This also applies to new permissions declared by app updates. When a
permission is denied or granted this way, the effect is equivalent to setting the permission
grant state via setPermissionGrantState(ComponentName, String, String, int).

As this policy only acts on runtime permission requests, it only applies to applications
built with a targetSdkVersion of M or later.

Parameters

admin

ComponentName:
Which profile or device owner this request is associated with.

setPermittedAccessibilityServices

Called by a profile or device owner to set the permitted accessibility services. When set by
a device owner or profile owner the restriction applies to all profiles of the user the
device owner or profile owner is an admin for. By default the user can use any accessiblity
service. When zero or more packages have been added, accessiblity services that are not in
the list and not part of the system can not be enabled by the user.

Calling with a null value for the list disables the restriction so that all services can be
used, calling with an empty list only allows the builtin system's services.

System accesibility services are always available to the user the list can't modify this.

setPermittedInputMethods

Called by a profile or device owner to set the permitted input methods services. When set by
a device owner or profile owner the restriction applies to all profiles of the user the
device owner or profile owner is an admin for. By default the user can use any input method.
When zero or more packages have been added, input method that are not in the list and not
part of the system can not be enabled by the user. This method will fail if it is called for
a admin that is not for the foreground user or a profile of the foreground user.

Calling with a null value for the list disables the restriction so that all input methods can
be used, calling with an empty list disables all but the system's own input methods.

System input methods are always available to the user this method can't modify this.

setProfileName

Sets the name of the profile. In the device owner case it sets the name of the user which it
is called from. Only a profile owner or device owner can call this. If this is never called
by the profile or device owner, the name will be set to default values.

setRecommendedGlobalProxy

Set a network-independent global HTTP proxy. This is not normally what you want for typical
HTTP proxies - they are generally network dependent. However if you're doing something
unusual like general internal filtering this may be useful. On a private network where the
proxy is not accessible, you may break HTTP using this.

This method requires the caller to be the device owner.

This proxy is only a recommendation and it is possible that some apps will ignore it.

setScreenCaptureDisabled

Called by a device/profile owner to set whether the screen capture is disabled. Disabling
screen capture also prevents the content from being shown on display devices that do not have
a secure video output. See FLAG_SECURE for more details about
secure surfaces and secure displays.

The calling device admin must be a device or profile owner. If it is not, a security
exception will be thrown.

From version M disabling screen capture also blocks
assist requests for all activities of the relevant user.

setShortSupportMessage

Called by a device admin to set the short support message. This will be displayed to the user
in settings screens where funtionality has been disabled by the admin. The message should be
limited to a short statement such as "This setting is disabled by your administrator. Contact
someone@example.com for support." If the message is longer than 200 characters it may be
truncated.

If the short support message needs to be localized, it is the responsibility of the
DeviceAdminReceiver to listen to the ACTION_LOCALE_CHANGED broadcast
and set a new version of this string accordingly.

setStorageEncryption

Called by an application that is administering the device to request that the storage system
be encrypted.

When multiple device administrators attempt to control device encryption, the most secure,
supported setting will always be used. If any device administrator requests device
encryption, it will be enabled; Conversely, if a device administrator attempts to disable
device encryption while another device administrator has enabled it, the call to disable will
fail (most commonly returning ENCRYPTION_STATUS_ACTIVE).

This policy controls encryption of the secure (application data) storage area. Data written
to other storage areas may or may not be encrypted, and this policy does not require or
control the encryption of any other storage areas. There is one exception: If
isExternalStorageEmulated() is true, then the
directory returned by getExternalStorageDirectory() must be
written to disk within the encrypted storage area.

Important Note: On some devices, it is possible to encrypt storage without requiring the user
to create a device PIN or Password. In this case, the storage is encrypted, but the
encryption key may not be fully secured. For maximum security, the administrator should also
require (and check for) a pattern, PIN, or password.

setTrustAgentConfiguration

Sets a list of configuration features to enable for a TrustAgent component. This is meant to
be used in conjunction with KEYGUARD_DISABLE_TRUST_AGENTS, which disables all trust
agents but those enabled by this function call. If flag
KEYGUARD_DISABLE_TRUST_AGENTS is not set, then this call has no effect.